Hewlett Packard Enterprise recently launched its Gen12 ProLiant server portfolio with a new Integrated Lights Out (iLO) 7 management controller. While the Gen12 promises to deliver considerable performance and efficiency gains, the biggest news may have been related to security, with claims of quantum resistance. As I’ve not seen this claim made by other server vendors, I was curious to learn how the company could make such a claim — and whether it held up under scrutiny.
This piece will dig deeper into the post-quantum cryptography (PQC) threat and what HPE is doing in response. If you’re interested in listening to my discussion with HPE about PQC and how the company is responding, you can see that here. Or you can read a deep analysis of the new security capabilities HPE designed for the ProLiant Gen12 platform in this Moor Insights & Strategy research brief.
It’s A Mad World
The cybersecurity market is evergreen, because each adaptive stage of the threat landscape is more complex and sinister than the previous. Viruses designed to wreak havoc on a corporate network have morphed into malware designed to steal, destroy, and lock up data for financial gain or more nefarious purposes. Each parry to an attack seems to give way to a new threat approaching from a new vector. Combine this with the growing number of attack surfaces, and we arrive at an environment where this constant game of whack-a-mole becomes the norm for CISO organizations.
When HPE launched its 10th generation of the ProLiant server portfolio in 2017, it gave enterprise IT organizations a decided advantage by ensuring that the environment a server was booting was pristine. With silicon root of trust, the company created an immutable fingerprint of each server during manufacturing. Signed drivers and firmware were burned into silicon, and as a server booted, every line of code was compared against this fingerprint.
Silicon root of trust didn’t just ensure a pristine boot environment; it constantly looked for any deviation from this fingerprint during operations. Anomaly detected? Server operations stopped, and IT administrators could either restore the server to the last known good operating environment or freeze it for a forensics investigation.
Over the past eight years or so, as the threat landscape has evolved, so too has iLO and the toolchain developed by HPE to address these new threats. Even in the era of AI-enabled malware, HPE has stayed ahead of the threat landscape.
Now comes the PQC threat, and all bets are off.
Post Quantum — It Isn’t Science Fiction
Quantum computing and PQC are real. While quantum is nascent, the barriers to its viability, such as error correction and hardware scale, are being resolved. We will start to see quantum shift from experimentation to (limited) operational deployment in the next year or two, with broad adoption coming in the 2030 timeframe. One of the early use cases we see emerging is cryptography.
This cryptographic capability has caused the most concern for cybersecurity professionals. In the PQC world, quantum computers using Shor’s algorithm will be able to break the encryption powering very popular key exchanges. Not only will they have the capability of breaking these encryption algorithms, but they will do so quickly — a problem that is considered infeasible for classical computers to solve due to the asymmetrical nature of the discrete logarithm problem.
In the PQC world, suddenly, the encryption solutions used to protect the enterprise are quite vulnerable. Frankly, even in today’s market, enterprise data is at risk. How is this? It’s called harvest now, decrypt later (HNDL). With HNDL, bad actors are stealing your data today and waiting for quantum computing cycles to become available.
What is the takeaway from all of this? It’s quite simple: The threat of PQC is real and relevant today. Because of this, enterprise IT organizations have to not only prepare for an advanced and exponentially more complex threat landscape — they must respond by deploying platforms and employing measures that can help counter the PQC threat. Fortunately, there are answers for these threats.
The Government Is Here To Help
In the U.S., the National Institute of Standards and Technology (NIST) develops standards tied to various enterprise technologies, including cloud computing and cybersecurity. One set of NIST standards is the Federal Information Processing Standards (FIPS). The latest published FIPS standard, 140-3, covers requirements for cryptographic modules. FIPS 140-3 has four levels, with level 3 focused specifically on key exchange.
This standard is an excellent reference for IT organizations looking to deploy PQC-resistant environments because it calls out the specific algorithms known to withstand attacks based on Shor’s Algorithm and others. NIST has validated several quantum resistant algorithms, including ML-KEM, ML-DSA, and SLH-DSA.
One last bit of information on this front: For enterprise organizations looking to better understand the overall post-quantum landscape and how to best prepare, the Linux Foundation has created a community known as Open Quantum Safe. I have found this to be a great resource.
HPE ProLiant Gen12 — Does It Deliver PQC Resistance?
The short answer is yes. HPE Gen12 ProLiant is PQC resistant and is certified to have achieved FIPS 140-3 Level 3 compliance.
iLO 7, the foundation for the server’s security posture, is new in ProLiant Gen12. In addition to strengthening the silicon root of trust, HPE has built a dedicated security processor called Secure Enclave (not to be confused with Intel’s program) that provides a quantum-resistant environment where keys, passwords, and other sensitive information are stored. This ensures that this data, part of the boot process, cannot be compromised or manipulated.
Just as iLO 7 delivers the boot environment that establishes a zero-trust foundation, SPDM — the security protocol and data model — is used to continuously verify the integrity of the devices that sit in the server by comparing against a baseline.
As an enterprise IT person, you might think that this is all good in theory, but could fall apart in practice because there are thousands or tens of thousands of servers across the enterprise. This is where HPE Compute Ops Manager (COM), aided by AI, comes into play. COM is that single pane of glass that allows an IT team to monitor and respond to IT incidents in real time. If an organization has embraced automation, COM can really deliver.
While HPE seems hesitant to call this AIOps, I think it is being a bit too modest. While COM is not at the fully autonomous phase of AIOps, it is undoubtedly well along the path and has enabled some level of task and process automation. Frankly, I have not yet seen any fully automated management frameworks, nor an IT organization willing to fully trust such a tool.
You can see the build-out here: With HPE ProLiant Gen 12, a secure chain of trust is established starting in the sourcing of materials (through HPE’s secure supply chain initiative) to manufacturing and on through the lifecycle of the server. This does not obviate the need for security tools; rather, it establishes a zero-trust foundation from which XDR and other security frameworks/platforms can operate. And it complements these tools.
Addressing Emerging Threats In The Present Tense
The cybersecurity landscape has always been dangerously fluid. Some call it an advanced game of whack-a-mole. I think of it as chess. With the introduction of AI and PQC, the stakes have been upped, and it may suddenly feel like the early days of AI when Deep Blue faced off against Gary Kasparov back in the 1990s.
While AI has seen some stalemate between bad actors and security professionals (though deepfakes are going to change this equation), QPC will be exponentially more difficult to defend against. To make matters worse, your infrastructure is surely vulnerable, as virtually all industry-standard servers are using encryption algorithms that cannot withstand an attack employing Shor’s algorithm. If you think of this as some present state, it’s not. But as touched on above, bad actors are harvesting data today for exploitation when they are able to consume quantum computational cycles.
HPE has been leading the platform security market since it introduced its ProLiant Gen10 platform back in 2017. While it has added incremental improvements over the years, iLO 7 in ProLiant Gen12 is the most significant update in the history of the product line, as it delivers PQC protections that enable a true zero-trust foundation.
It may seem odd to discuss the post-quantum world when the market has yet to materialize. However, while there are many unknowns that vendors like HPE will have to respond to, it’s encouraging to see HPE being proactive about what is known.
